CVE-2026-2293highCWE-551CWE-863

CVE-2026-2293: high-severity vulnerability in nest.js

NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass

Published · Updated

Follow this CVE+ Monitor nest.js+ Monitor @nestjs/platform-fastify

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.8%
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
nest.js · nest.js